Damn. Thanks for providing the detailed post-mortem for posterity. This is a good reminder (again), just like the Bitpay/copay/event-stream hack, developers of financial software have an overwhelming responsibility to test the living shit out of supposedly supported software integrations and dependencies to prevent end users from attacks/exploits. Simply saying “this is beta/experimental software” is not going to fly.